Fwd: OSSEC Alert - annun10 - Level 13 - Non standard syslog message (size too large).

[Lance Lassetter]

Just upgraded to FC22.  And spamd crashes alot.

-------- Original Message --------
From: OSSEC HIDS 
Sent: May 29, 2015 10:05:08 AM CDT
To: root@localhost
Subject: OSSEC Alert - annun10 - Level 13 - Non standard syslog message (size too large).

OSSEC HIDS Notification.
2015 May 29 10:04:34

Received From: annun10->/var/log/messages
Rule: 1003 fired (level 13) -> "Non standard syslog message (size too large)."
Portion of the log(s):

May 29 10:04:32 annun10 systemd-coredump: Process 8264 (spamd) of user 0 dumped core.#012#012Stack trace of thread 8264:#012#0  0x00007fd515e6526e boot_MIME__Base64 (Base64.so)#012#1  0x00007fd51f67867b Perl_pp_entersub (libperl.so.5.20)#012#2  0x00007fd51f670f06 Perl_runops_standard (libperl.so.5.20)#012#3  0x00007fd51f5f9286 Perl_call_sv (libperl.so.5.20)#012#4  0x00007fd51f5fb533 Perl_call_list (libperl.so.5.20)#012#5  0x00007fd51f5def61 S_process_special_blocks (libperl.so.5.20)#012#6  0x00007fd51f5f2907 Perl_newATTRSUB_x (libperl.so.5.20)#012#7  0x00007fd51f5f5967 Perl_utilize (libperl.so.5.20)#012#8  0x00007fd51f628cad Perl_yyparse (libperl.so.5.20)#012#9  0x00007fd51f6ab4dd S_doeval (libperl.so.5.20)#012#10 0x00007fd51f6b6962 Perl_pp_require (libperl.so.5.20)#012#11 0x00007fd51f670f06 Perl_runops_standard (libperl.so.5.20)#012#12 0x00007fd51f5f9286 Perl_call_sv (libperl.so.5.20)#012#13 0x00007fd51f5fb533 Perl_call_list (libperl.so.5.20)#012#14 0x00007fd51f5def61
S_process_spec
 ial_blocks (libperl.so.5.20)#012#15 0x00007fd51f5f2907 Perl_newATTRSUB_x (libperl.so.5.20)#012#16 0x00007fd51f5f5967 Perl_utilize (libperl.so.5.20)#012#17 0x00007fd51f628cad Perl_yyparse (libperl.so.5.20)#012#18 0x00007fd51f6ab4dd S_doeval (libperl.so.5.20)#

--END OF NOTIFICATION

OSSEC HIDS Notification.
2015 May 29 10:04:38

Received From: annun10->/var/log/messages
Rule: 1003 fired (level 13) -> "Non standard syslog message (size too large)."
Portion of the log(s):

May 29 10:04:36 annun10 systemd-coredump: Process 8267 (spamd) of user 0 dumped core.#012#012Stack trace of thread 8267:#012#0  0x00007f1d5ff7a26e boot_MIME__Base64 (Base64.so)#012#1  0x00007f1d6978d67b Perl_pp_entersub (libperl.so.5.20)#012#2  0x00007f1d69785f06 Perl_runops_standard (libperl.so.5.20)#012#3  0x00007f1d6970e286 Perl_call_sv (libperl.so.5.20)#012#4  0x00007f1d69710533 Perl_call_list (libperl.so.5.20)#012#5  0x00007f1d696f3f61 S_process_special_blocks (libperl.so.5.20)#012#6  0x00007f1d69707907 Perl_newATTRSUB_x (libperl.so.5.20)#012#7  0x00007f1d6970a967 Perl_utilize (libperl.so.5.20)#012#8  0x00007f1d6973dcad Perl_yyparse (libperl.so.5.20)#012#9  0x00007f1d697c04dd S_doeval (libperl.so.5.20)#012#10 0x00007f1d697cb962 Perl_pp_require (libperl.so.5.20)#012#11 0x00007f1d69785f06 Perl_runops_standard (libperl.so.5.20)#012#12 0x00007f1d6970e286 Perl_call_sv (libperl.so.5.20)#012#13 0x00007f1d69710533 Perl_call_list (libperl.so.5.20)#012#14 0x00007f1d696f3f61
S_process_spec
 ial_blocks (libperl.so.5.20)#012#15 0x00007f1d69707907 Perl_newATTRSUB_x (libperl.so.5.20)#012#16 0x00007f1d6970a967 Perl_utilize (libperl.so.5.20)#012#17 0x00007f1d6973dcad Perl_yyparse (libperl.so.5.20)#012#18 0x00007f1d697c04dd S_doeval (libperl.so.5.20)#

--END OF NOTIFICATION

OSSEC HIDS Notification.
2015 May 29 10:04:42

Received From: annun10->/var/log/messages
Rule: 1003 fired (level 13) -> "Non standard syslog message (size too large)."
Portion of the log(s):

May 29 10:04:41 annun10 systemd-coredump: Process 8270 (spamd) of user 0 dumped core.#012#012Stack trace of thread 8270:#012#0  0x00007f9840b8b26e boot_MIME__Base64 (Base64.so)#012#1  0x00007f984a39e67b Perl_pp_entersub (libperl.so.5.20)#012#2  0x00007f984a396f06 Perl_runops_standard (libperl.so.5.20)#012#3  0x00007f984a31f286 Perl_call_sv (libperl.so.5.20)#012#4  0x00007f984a321533 Perl_call_list (libperl.so.5.20)#012#5  0x00007f984a304f61 S_process_special_blocks (libperl.so.5.20)#012#6  0x00007f984a318907 Perl_newATTRSUB_x (libperl.so.5.20)#012#7  0x00007f984a31b967 Perl_utilize (libperl.so.5.20)#012#8  0x00007f984a34ecad Perl_yyparse (libperl.so.5.20)#012#9  0x00007f984a3d14dd S_doeval (libperl.so.5.20)#012#10 0x00007f984a3dc962 Perl_pp_require (libperl.so.5.20)#012#11 0x00007f984a396f06 Perl_runops_standard (libperl.so.5.20)#012#12 0x00007f984a31f286 Perl_call_sv (libperl.so.5.20)#012#13 0x00007f984a321533 Perl_call_list (libperl.so.5.20)#012#14 0x00007f984a304f61
S_process_spec
 ial_blocks (libperl.so.5.20)#012#15 0x00007f984a318907 Perl_newATTRSUB_x (libperl.so.5.20)#012#16 0x00007f984a31b967 Perl_utilize (libperl.so.5.20)#012#17 0x00007f984a34ecad Perl_yyparse (libperl.so.5.20)#012#18 0x00007f984a3d14dd S_doeval (libperl.so.5.20)#

--END OF NOTIFICATION

OSSEC HIDS Notification.
2015 May 29 10:04:46

Received From: annun10->/var/log/messages
Rule: 1003 fired (level 13) -> "Non standard syslog message (size too large)."
Portion of the log(s):

May 29 10:04:45 annun10 systemd-coredump: Process 8301 (spamd) of user 0 dumped core.#012#012Stack trace of thread 8301:#012#0  0x00007f9d7513d26e boot_MIME__Base64 (Base64.so)#012#1  0x00007f9d7e95067b Perl_pp_entersub (libperl.so.5.20)#012#2  0x00007f9d7e948f06 Perl_runops_standard (libperl.so.5.20)#012#3  0x00007f9d7e8d1286 Perl_call_sv (libperl.so.5.20)#012#4  0x00007f9d7e8d3533 Perl_call_list (libperl.so.5.20)#012#5  0x00007f9d7e8b6f61 S_process_special_blocks (libperl.so.5.20)#012#6  0x00007f9d7e8ca907 Perl_newATTRSUB_x (libperl.so.5.20)#012#7  0x00007f9d7e8cd967 Perl_utilize (libperl.so.5.20)#012#8  0x00007f9d7e900cad Perl_yyparse (libperl.so.5.20)#012#9  0x00007f9d7e9834dd S_doeval (libperl.so.5.20)#012#10 0x00007f9d7e98e962 Perl_pp_require (libperl.so.5.20)#012#11 0x00007f9d7e948f06 Perl_runops_standard (libperl.so.5.20)#012#12 0x00007f9d7e8d1286 Perl_call_sv (libperl.so.5.20)#012#13 0x00007f9d7e8d3533 Perl_call_list (libperl.so.5.20)#012#14 0x00007f9d7e8b6f61
S_process_spec
 ial_blocks (libperl.so.5.20)#012#15 0x00007f9d7e8ca907 Perl_newATTRSUB_x (libperl.so.5.20)#012#16 0x00007f9d7e8cd967 Perl_utilize (libperl.so.5.20)#012#17 0x00007f9d7e900cad Perl_yyparse (libperl.so.5.20)#012#18 0x00007f9d7e9834dd S_doeval (libperl.so.5.20)#

--END OF NOTIFICATION

OSSEC HIDS Notification.
2015 May 29 10:04:50

Received From: annun10->/var/log/messages
Rule: 1003 fired (level 13) -> "Non standard syslog message (size too large)."
Portion of the log(s):

May 29 10:04:49 annun10 systemd-coredump: Process 8304 (spamd) of user 0 dumped core.#012#012Stack trace of thread 8304:#012#0  0x00007f48a536126e boot_MIME__Base64 (Base64.so)#012#1  0x00007f48aeb7467b Perl_pp_entersub (libperl.so.5.20)#012#2  0x00007f48aeb6cf06 Perl_runops_standard (libperl.so.5.20)#012#3  0x00007f48aeaf5286 Perl_call_sv (libperl.so.5.20)#012#4  0x00007f48aeaf7533 Perl_call_list (libperl.so.5.20)#012#5  0x00007f48aeadaf61 S_process_special_blocks (libperl.so.5.20)#012#6  0x00007f48aeaee907 Perl_newATTRSUB_x (libperl.so.5.20)#012#7  0x00007f48aeaf1967 Perl_utilize (libperl.so.5.20)#012#8  0x00007f48aeb24cad Perl_yyparse (libperl.so.5.20)#012#9  0x00007f48aeba74dd S_doeval (libperl.so.5.20)#012#10 0x00007f48aebb2962 Perl_pp_require (libperl.so.5.20)#012#11 0x00007f48aeb6cf06 Perl_runops_standard (libperl.so.5.20)#012#12 0x00007f48aeaf5286 Perl_call_sv (libperl.so.5.20)#012#13 0x00007f48aeaf7533 Perl_call_list (libperl.so.5.20)#012#14 0x00007f48aeadaf61
S_process_spec
 ial_blocks (libperl.so.5.20)#012#15 0x00007f48aeaee907 Perl_newATTRSUB_x (libperl.so.5.20)#012#16 0x00007f48aeaf1967 Perl_utilize (libperl.so.5.20)#012#17 0x00007f48aeb24cad Perl_yyparse (libperl.so.5.20)#012#18 0x00007f48aeba74dd S_doeval (libperl.so.5.20)#

--END OF NOTIFICATION

OSSEC HIDS Notification.
2015 May 29 10:04:54

Received From: annun10->/var/log/messages
Rule: 1003 fired (level 13) -> "Non standard syslog message (size too large)."
Portion of the log(s):

May 29 10:04:53 annun10 systemd-coredump: Process 8307 (spamd) of user 0 dumped core.#012#012Stack trace of thread 8307:#012#0  0x00007fc60b53326e boot_MIME__Base64 (Base64.so)#012#1  0x00007fc614d4667b Perl_pp_entersub (libperl.so.5.20)#012#2  0x00007fc614d3ef06 Perl_runops_standard (libperl.so.5.20)#012#3  0x00007fc614cc7286 Perl_call_sv (libperl.so.5.20)#012#4  0x00007fc614cc9533 Perl_call_list (libperl.so.5.20)#012#5  0x00007fc614cacf61 S_process_special_blocks (libperl.so.5.20)#012#6  0x00007fc614cc0907 Perl_newATTRSUB_x (libperl.so.5.20)#012#7  0x00007fc614cc3967 Perl_utilize (libperl.so.5.20)#012#8  0x00007fc614cf6cad Perl_yyparse (libperl.so.5.20)#012#9  0x00007fc614d794dd S_doeval (libperl.so.5.20)#012#10 0x00007fc614d84962 Perl_pp_require (libperl.so.5.20)#012#11 0x00007fc614d3ef06 Perl_runops_standard (libperl.so.5.20)#012#12 0x00007fc614cc7286 Perl_call_sv (libperl.so.5.20)#012#13 0x00007fc614cc9533 Perl_call_list (libperl.so.5.20)#012#14 0x00007fc614cacf61
S_process_spec
 ial_blocks (libperl.so.5.20)#012#15 0x00007fc614cc0907 Perl_newATTRSUB_x (libperl.so.5.20)#012#16 0x00007fc614cc3967 Perl_utilize (libperl.so.5.20)#012#17 0x00007fc614cf6cad Perl_yyparse (libperl.so.5.20)#012#18 0x00007fc614d794dd S_doeval (libperl.so.5.20)#

--END OF NOTIFICATION

OSSEC HIDS Notification.
2015 May 29 10:04:58

Received From: annun10->/var/log/messages
Rule: 1003 fired (level 13) -> "Non standard syslog message (size too large)."
Portion of the log(s):

May 29 10:04:58 annun10 systemd-coredump: Process 8310 (spamd) of user 0 dumped core.#012#012Stack trace of thread 8310:#012#0  0x00007f93c1f5126e boot_MIME__Base64 (Base64.so)#012#1  0x00007f93cb76467b Perl_pp_entersub (libperl.so.5.20)#012#2  0x00007f93cb75cf06 Perl_runops_standard (libperl.so.5.20)#012#3  0x00007f93cb6e5286 Perl_call_sv (libperl.so.5.20)#012#4  0x00007f93cb6e7533 Perl_call_list (libperl.so.5.20)#012#5  0x00007f93cb6caf61 S_process_special_blocks (libperl.so.5.20)#012#6  0x00007f93cb6de907 Perl_newATTRSUB_x (libperl.so.5.20)#012#7  0x00007f93cb6e1967 Perl_utilize (libperl.so.5.20)#012#8  0x00007f93cb714cad Perl_yyparse (libperl.so.5.20)#012#9  0x00007f93cb7974dd S_doeval (libperl.so.5.20)#012#10 0x00007f93cb7a2962 Perl_pp_require (libperl.so.5.20)#012#11 0x00007f93cb75cf06 Perl_runops_standard (libperl.so.5.20)#012#12 0x00007f93cb6e5286 Perl_call_sv (libperl.so.5.20)#012#13 0x00007f93cb6e7533 Perl_call_list (libperl.so.5.20)#012#14 0x00007f93cb6caf61
S_process_spec
 ial_blocks (libperl.so.5.20)#012#15 0x00007f93cb6de907 Perl_newATTRSUB_x (libperl.so.5.20)#012#16 0x00007f93cb6e1967 Perl_utilize (libperl.so.5.20)#012#17 0x00007f93cb714cad Perl_yyparse (libperl.so.5.20)#012#18 0x00007f93cb7974dd S_doeval (libperl.so.5.20)#

--END OF NOTIFICATION

OSSEC Alert - annun10 - Level 13 - Non standard syslog message (size too large).

[Josh Boyer]

On Fri, May 29, 2015 at 11:06 AM, Lance Lassetter
 wrote:
> Just upgraded to FC22.  And spamd crashes alot.

Please report a bug in bugzilla against the spamassassin component.

I don't see how anything here is related to the kernel.

josh